Login once with per day with 2FA and rest of day with username/password only

[ArjenVHooydonk]

Hi,

From our security team I have a requirement that a group if users login to SAP SuccessFactors using 2FA once per day. Once they have logged in with 2FA they need to login using username/password only for the rest of the day. The rest of the employees login using username/password every single login.

For some reason the first scenario is working as required, but the second isn't. We have setup the IAS session to stay alive for 8 hours. When a user in the 2FA group logs in after the 30 minute time out in SuccessFactors expires they only need to enter username/password (seems like a bug to me). But the secord group (not using 2FA, only username/password) doesn't have to login again and can keep on using SuccessFactors for the entire 8 hours.

Is it possible to configure this in Identity Access Services (IAS)? As far as I know you can only configure how long the IAS session remains alive, so if the session ends the user will need to login again with 2FA. No way to switch between 2FA and username/password depending on last time 2FA was used.

Hope someone can point me in the right direction. @haidongsong @harjeetjudge 

Arjen

[haidongsong]

you are correct that we can not set up a conditional rules to switch between 2FA and username/pwd depending on the last time 2FA login. 

BTW, what are the issue with a 8hr timeout period for regular users using username/pwd? 

[ArjenVHooydonk]

thank you for your response. The security officers deem the 8 hour time out period too long and want to maintain the 30 minute inactivity time out used by SuccessFactors

[haidongsong]

then in order to maintain the 30 min time out, the IAS session time out would need to be set at 30 min as well.